WIXLIB

Idaho Division of Vocational Rehabilitation –Internal Control FrameworkMission StatementTo prepare individuals with disabilities for employment and careeropportunities while meeting the needs of employers.Vision StatementAn Idaho where all individuals with disabilities have the opportunity toparticipate in the workforce and employers’ value their contributions.0.PreambleThe management of projects is key to providing value for money anddemonstrating sound stewardship in program administration and delivery.A comprehensive approach to managing projects, which is integratedacross the Division and is appropriate for the level of project risk andcomplexity will enhance the likelihood of realizing project objectives, andsubsequently advancing the mission of IDVR. Implementing acomprehensive internal control framework should provide reasonableassurance that: IDVR is expending general grant dollars ethically and responsiblyOperations are monitored for efficiency and effectiveness,operational objectives are checked against results to promotecontinuous improvementReports are based on accurate and complete dataIDVR is in compliance with federal regulations, state statutes andrules, and Divisional policies.Program staff have the necessary training and competencies toprovider quality servicesAccountability for projects is transparent, results on projects aremonitored and communicatedControls are appropriate and proportional to the risk appetite of theDivisionControls are in place to minimize risk and limit redundancy

Internal and external stakeholders have an opportunity formeaningful input and that input is seriously considered by theDivisionState and Federal reports are based on reliable data anddecisions are driven by reliable dataTimely outcomes are achievedSensitive customer data are protectedObjectiveThe objective of this internal control framework is to providereasonable assurance that appropriate systems, processes and controls formanaging the state-federal VR grant are in place throughout IDVR andsupport the achievement of objectives while limiting risk to customers andother stakeholders.Documentation StructureThis document (the ICIF Master Narrative) provides a high-level overviewof IDVR’s internal control framework. Linkages of principles andstatements found in this document to supporting documentation can befound under the associated component folder maintained on IDVR’sintranet here:C0 Other – Non-discrete Internal Control Activities that do not align into asingle category or Green Book elementC1 Control EnvironmentC2 Risk AssessmentC3 Control ActivitiesC4 Information & CommunicationC5 Monitoring ActivitiesICS Annual Assurances (ICS Design Adequacy Review/ICS EffectivenessReview).These documents in conjunction with supporting documentation eithersystematically address the components, principles, and attributescontained within the Green Book, provide rationale for not addressing a

principle, or do not discretely align with a principle due to project scope andare addressed separately.Definition of Internal ControlInternal control (IC) encompasses the plans, methods, policies, andprocedures used to realize the mission, strategic plan, goals and objectivesof IDVR. IC is a dynamic, iterative, and integrated process, effected by allemployees of the Division, and is used by management to achieve evolvingobjectives on an ongoing basis as a part of the continuous improvementand compliance activities of IDVR. An internal control frameworkrepresents the agency’s plan to meet the following requirements of 2 CFR§ 200.303 providing reasonable assurance of: IDVR’s compliance with Federal statutes, regulations and theterms and conditions of the Federal awardsEvaluation and monitoring of IDVR’s compliance on an ongoingbasisTimely action is taken when noncompliance is identifiedPersonally identifiable information (PII) and other sensitive dataare protected consistent with applicable laws and regulationsEffective and Compliant Framework RequirementsThe Uniform Administrative Requirements, at 2 CFR §200.303 mandate thecreation and maintenance of an effective internal control framework. Morespecifically, the regulations require an alignment with the “Standards forInternal Control in the Federal Government” (aka the Green Book)published by the Comptroller General of the United States and the “InternalControl – Integrated Framework” issued by the Committee of SponsoringOrganizations of the Treadway Commission (COSO). IDVR uses theGreen Book and COSO’s Integrated Framework documents throughout thisinternal control framework, including adherence to the requireddocumentation of IC activities outlined in the Green Book.Commented [MM1]: Need written policy on this in thebooks per 34 CFR 361.38(a)

Figure X. The Five Components and 17 principles of Internal ControlThe Green Book’s components and principles should be applied across allIDVR operations, reporting and compliance objectives. Any omission of theapplication of a principle must be addressed, justified and documented byIDVR’s oversight body.

Figure 1: The Components, Objectives, and Organizational Structure of InternalControl. United States Government Accountability Office (GAO), 2014.The Green Book explains that IDVR’s objectives are directly related to thefive components of internal control and the Division’s organizationalstructure:From the Green Book overview 2.04: The five components represent thehighest level of the hierarchy of standards for internal control in the federalgovernment. The five components of internal control must be effectivelydesigned, implemented, and operating, and operating together in anintegrated manner, for an internal control system to be effective. The fivecomponents of internal control are as follows:1. Control Environment - The foundation for an internal control system.It provides the discipline and structure to help an entity achieve itsobjectives.2. Risk Assessment - Assesses the risks facing the entity as it seeks toachieve its objectives. This assessment provides the basis fordeveloping appropriate risk responses.

3. Control Activities- The actions management establishes throughpolicies and procedures to achieve objectives and respond to risks inthe internal control system, which includes the entity’s informationsystem.4. Information and Communication- The quality informationmanagement and personnel communicate and use to support theinternal control system.5. Monitoring- Activities management establishes and operates toassess the quality of performance over time and promptly resolve thefindings of audits and other reviews. Objectives represent what IDVR wants to achieve, they can beoperational, reporting or compliance objectives (or a combination).The five components of IC (Control environment, risk assessment,control activities, and information/communication) are required forthe agency to achieve these objectives.The organizational structure includes the various operating units,operational processes and management structures available touse in achieving these objectives.o Every Division employee has a role in IC, however IC rolesgenerally fall into one of the following: Oversight body: Responsible for overseeing the strategicdirection and accountability of IDVR to include the design,implementation, and operation of this IC system. Management: Directly responsible for all activities ofIDVR including the design, implementation andeffectiveness of the IC system. Personnel: Assist in IC design, implementation andoperation. Responsible for reporting issues with meetingobjectives. External Auditors are not a part of IDVR’s IC system, butcan help note recommendations for improving the ICsystem. Findings/weaknesses identified by externalauditors, however, will be addressed through thisframework.

Defining Operations, Reporting and Compliance Objectivesfor IDVR:Objectives are established by management with the in conjunction withIDVR’s oversight body. Objectives relate to the mission, strategic plan andgoals of IDVR as well as achieving regulatory compliance. OperationalObjectives established by the agency must be specific, measurable andinclude targets. IDVR considers compliance and data reliability objectivescompulsory, and consequently sets targets for compliance at 100 percent.The scope of operational objectives included in IDVR’s work plan/riskmitigation plan will be a function of the risk appetite of the agency and theagency’s ability to conduct effective monitoring without having a significantnegative impact on the day-to-day field operations. Minimum allotmentagencies like IDVR have fewer resources to dedicate to oversight and mustbalance control activities and the ability to conduct business. Furthermore,due to the size of the agency, separation of duties is an essentialconsideration in the assignment of responsibility for objectives.Management may set subobjectives forregions/offices/caseloads/individuals when applicable. This document inparticular covers entity level controls (those controls which are applicableglobally across the Division).The Green Book categorizes objectives into three non-discrete categories:Operations, Reporting and Compliance (2 CFR 200.61): Operational objectives are focused on improving the effectiveness(improved outcomes) and/or efficiency (reduced waste) of businessoperations and are mission driven. Reporting objectives work to promote the reliability of reports (e.g.RSA-911, SF-425, RSA-2, ETA-9169) and ensure the agency ismaking decisions based on quality data. Compliance objectives (2 CFR 200.62) work to meet therequirements of germane program laws and regulations (to includeprescribed/mandatory objectives). Again, IDVR management mustconsider compliance objectives comprehensively before balancingcontrols and workload.Commented [MM2]: Fiscal must haves plus termsand conditions of grant and compliance with associatedregulations (will follow fiscal and other federal regs)

Normative References for IDVR’s Internal ControlFramework (External References)Standards for Internal Control in the Federal Government (the “GreenBook”) GAO-14-704G (U.S. Government Accountability Office, 2014)online: https://www.gao.gov/products/GAO-14-704GInternal Control – Integrated Framework (2013). Committee of SponsoringOrganizations of the Treadway Commission. g COSO Across the Three Lines of Defense (2015). Anderson,D.J. & Eubanks, G. idance on Monitoring Internal Control Systems (2009). Committee ofSponsoring Organizations of the Treadway Commission